@indigoai-us/hq-cli 5.345.9 → 5.345.11

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [5.345.11] — 2026-10-05
+- Fix Windows parity for delegate, scheduled job, and session helpers.
+
+## [5.345.10] — 2026-10-05
+- Keep a healthy recorded Claude account for lane messages when every worker-profile-pinned account is unavailable.
+
 ## [5.345.9] — 2026-10-05
 - Lane messages to exited sessions now queue durably when provider admission is busy, so delivery succeeds and reconcile can resume them later.
 - Keep the current sync runner until an hq-cloud version matching the configured pin is available.

package/assets/scaffold/core/scripts/hq-delegate-grant.sh

@@ -35,11 +35,18 @@ die()   { echo "hq-delegate-grant: $*" >&2; exit 1; }
 
 command -v jq >/dev/null 2>&1 || die "jq is required but not installed"
 
-# jq.exe on Windows emits CRLF data; remove only its line-ending CR bytes.
-case "${OSTYPE:-}" in
-  msys*)
+# jq.exe's binary mode avoids CRT newline conversion without changing real CR bytes.
+case "${OSTYPE:-}:${MSYSTEM:-}" in
+  msys*:*|*:MINGW*)
     jq() {
-      command jq "$@" | command sed -b 's/\r$//'
+      local stdout_file stderr_file status
+      stdout_file="$(mktemp)" || return $?
+      stderr_file="$(mktemp)" || { status=$?; rm -f "$stdout_file"; return "$status"; }
+      if command jq --binary "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
+      command sed -b 's/\r$//' "$stdout_file"
+      command sed -b 's/\r$//' "$stderr_file" >&2
+      rm -f "$stdout_file" "$stderr_file"
+      return "$status"
     }
     ;;
 esac

package/assets/scaffold/core/scripts/hq-delegate-send.sh

@@ -40,11 +40,18 @@ die()   { echo "hq-delegate-send: $*" >&2; exit 1; }
 
 command -v jq >/dev/null 2>&1 || die "jq is required but not installed"
 
-# jq.exe on Windows emits CRLF data; remove only its line-ending CR bytes.
-case "${OSTYPE:-}" in
-  msys*)
+# jq.exe's binary mode avoids CRT newline conversion without changing real CR bytes.
+case "${OSTYPE:-}:${MSYSTEM:-}" in
+  msys*:*|*:MINGW*)
     jq() {
-      command jq "$@" | command sed -b 's/\r$//'
+      local stdout_file stderr_file status
+      stdout_file="$(mktemp)" || return $?
+      stderr_file="$(mktemp)" || { status=$?; rm -f "$stdout_file"; return "$status"; }
+      if command jq --binary "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
+      command sed -b 's/\r$//' "$stdout_file"
+      command sed -b 's/\r$//' "$stderr_file" >&2
+      rm -f "$stdout_file" "$stderr_file"
+      return "$status"
     }
     ;;
 esac

package/assets/scaffold/core/scripts/hq-job-probe.sh

@@ -120,11 +120,18 @@ done
 command -v yq >/dev/null 2>&1 || die "yq is required (mikefarah/yq)"
 command -v jq >/dev/null 2>&1 || die "jq is required"
 
-# jq.exe on Windows emits CRLF data; remove only its line-ending CR bytes.
-case "${OSTYPE:-}" in
-  msys*)
+# jq.exe's binary mode avoids CRT newline conversion without changing real CR bytes.
+case "${OSTYPE:-}:${MSYSTEM:-}" in
+  msys*:*|*:MINGW*)
     jq() {
-      command jq "$@" | command sed -b 's/\r$//'
+      local stdout_file stderr_file status
+      stdout_file="$(mktemp)" || return $?
+      stderr_file="$(mktemp)" || { status=$?; rm -f "$stdout_file"; return "$status"; }
+      if command jq --binary "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
+      command sed -b 's/\r$//' "$stdout_file"
+      command sed -b 's/\r$//' "$stderr_file" >&2
+      rm -f "$stdout_file" "$stderr_file"
+      return "$status"
     }
     ;;
 esac

package/assets/scaffold/core/scripts/jobs-validate.sh

@@ -40,11 +40,18 @@ command -v jq >/dev/null 2>&1 || {
   exit 2
 }
 
-# jq.exe on Windows emits CRLF data; remove only its line-ending CR bytes.
-case "${OSTYPE:-}" in
-  msys*)
+# jq.exe's binary mode avoids CRT newline conversion without changing real CR bytes.
+case "${OSTYPE:-}:${MSYSTEM:-}" in
+  msys*:*|*:MINGW*)
     jq() {
-      command jq "$@" | command sed -b 's/\r$//'
+      local stdout_file stderr_file status
+      stdout_file="$(mktemp)" || return $?
+      stderr_file="$(mktemp)" || { status=$?; rm -f "$stdout_file"; return "$status"; }
+      if command jq --binary "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
+      command sed -b 's/\r$//' "$stdout_file"
+      command sed -b 's/\r$//' "$stderr_file" >&2
+      rm -f "$stdout_file" "$stderr_file"
+      return "$status"
     }
     ;;
 esac

package/assets/scaffold/core/scripts/session-journal.sh

@@ -36,8 +36,8 @@ journal_dir_for() {
 warn() { echo "session-journal: $*" >&2; }
 
 slugify() {
-  # Lowercase, replace non-alnum with hyphen, collapse hyphens, trim.
-  printf '%s' "$1" \
+  # Win32 rejects newline file-name bytes; otherwise keep the POSIX slug pipeline.
+  local slug_input="$1"; if [[ "${OSTYPE:-}" == msys* ]] || [[ "${MSYSTEM:-}" == MINGW* ]]; then slug_input="${slug_input//$'\n'/-}"; fi; printf '%s' "$slug_input" \
     | tr '[:upper:]' '[:lower:]' \
     | sed -E 's/[^a-z0-9]+/-/g; s/^-+//; s/-+$//' \
     | cut -c1-40
@@ -161,7 +161,7 @@ next_seq() {
 
 acquire_journal_write_lock() {
   local lock="$1/.session-journal-write.lock" owner=0 i=0
-  while [ "$i" -lt 250 ]; do
+  while [[ "$i" -lt 250 || ( "${OSTYPE:-}" == msys* && "$i" -lt 1500 ) ]]; do
     if mkdir "$lock" 2>/dev/null; then
       printf '%s\n' "$$" > "$lock/pid" || { rm -rf "$lock"; return 1; }
       JOURNAL_WRITE_LOCK="$lock"

package/dist/commands/core-delegate-w1b.js

@@ -373,7 +373,10 @@ function emitJqParseDiagnostic(input, args, context) {
     if (!commandExists("jq", context.cwd))
         return;
     const result = subprocess("jq", args, context.cwd, { input, stdout: "ignore", stderr: "pipe" });
-    const diagnostic = result.stderrBytes ?? Buffer.from(result.stderr ?? "");
+    const rawDiagnostic = result.stderrBytes ?? Buffer.from(result.stderr ?? "");
+    const diagnostic = process.platform === "win32"
+        ? Buffer.from(rawDiagnostic.toString("latin1").replace(/\r(?=\n|$)/g, ""), "latin1")
+        : rawDiagnostic;
     if (diagnostic.length)
         err(diagnostic);
 }

package/dist/commands/core-hq-session-native.js

@@ -243,7 +243,11 @@ function timestamp(date) {
 }
 function currentMetaPath(root, sessionOverride, deps) {
     const id = sessionOverride || resolveSessionId(root, deps);
-    return id ? path.join(root, "workspace", "sessions", id, "meta.yaml") : "";
+    return id
+        ? process.platform === "win32"
+            ? `${root}/workspace/sessions/${id}/meta.yaml`
+            : path.join(root, "workspace", "sessions", id, "meta.yaml")
+        : "";
 }
 function exactCompanyDir(root, slug, deps) {
     if (!root || !slug)

package/dist/commands/core-session-journal-native.js

@@ -23,7 +23,7 @@ const counterKey = (value) => {
         key = "unscoped";
     return key.length > 96 ? key.slice(0, 96) : key;
 };
-const slugify = (value) => value.toLowerCase()
+const slugify = (input) => (process.platform === "win32" ? input.replaceAll("\n", "-") : input).toLowerCase()
     .split("\n")
     .map((line) => line.replace(/[^a-z0-9]+/g, "-").replace(/^-+/, "").replace(/-+$/, "").slice(0, 40))
     .join("\n");
@@ -92,7 +92,7 @@ function processIsAlive(pid) {
 function acquireJournalWriteLock(dir) {
     const lock = path.join(dir, ".session-journal-write.lock");
     const ownerFile = path.join(lock, "pid");
-    const deadline = Date.now() + 5_000;
+    const deadline = Date.now() + (process.platform === "win32" ? 30_000 : 5_000);
     while (Date.now() < deadline) {
         try {
             fs.mkdirSync(lock);

package/dist/commands/core-session-project-native.js

@@ -252,7 +252,8 @@ export function runSessionProjectFast(argv, stdin, cwd, root, dependencies = {})
     function acquireProjectWriteLock(prdPath) {
         const lock = `${prdPath}.write-lock`;
         const ownerFile = path.join(lock, "pid");
-        const deadline = Date.now() + 5_000;
+        // Git Bash and Node process startup can stretch Windows lock contention beyond the short POSIX window.
+        const deadline = Date.now() + (process.platform === "win32" ? 30_000 : 5_000);
         while (Date.now() < deadline) {
             try {
                 fs.mkdirSync(lock);

package/dist/commands/lanes.js

@@ -6791,18 +6791,62 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
         (model === undefined || currentConfig.model === undefined || currentConfig.model === model ||
             lane.account === recordedModelAccount))
         return undefined;
-    const selected = selectClaudeAccount({
+    const selectionInput = {
         hosts: balanceHosts.snapshots,
         targetHost: lane.host,
         config,
         quotaState: loadQuotaState(hqRoot),
         recentUsageEnabled: await readClaudeAccountBalanceSignalsEnabled(ctx, lane.company ?? undefined),
         now: ctx.now(),
-        ...(!repairUnavailableAccount && allowedAccounts !== undefined ? { allowedAccounts } : {}),
         ...(model !== undefined ? { model } : {}),
         ...(recordedModelAccount !== undefined ? { recordedModelAccount } : {}),
         unavailableHosts: balanceHosts.unavailableHosts,
-    });
+    };
+    let selected;
+    let profilePinUnavailable = false;
+    try {
+        selected = selectClaudeAccount({
+            ...selectionInput,
+            ...(!repairUnavailableAccount && allowedAccounts !== undefined ? { allowedAccounts } : {}),
+        });
+    }
+    catch (err) {
+        const accountReasons = err instanceof LanesError &&
+            err.error === "claude_account_balance_no_eligible_account" &&
+            Array.isArray(err.details.account_reasons)
+            ? err.details.account_reasons.filter((reason) => reason !== null && typeof reason === "object" && !Array.isArray(reason))
+            : [];
+        const unavailablePinReasons = new Set(["disabled", "home_missing", "not_logged_in", "model_mismatch", "quota_held"]);
+        const everyProfileAccountUnavailable = profilePin !== undefined && profilePin.length > 0 &&
+            profilePin.every((account) => accountReasons.some((reason) => reason.account === account && typeof reason.reason === "string" && unavailablePinReasons.has(reason.reason)));
+        if (!everyProfileAccountUnavailable || lane.account === undefined ||
+            (lane.admission_accounts !== undefined && !lane.admission_accounts.includes(lane.account)))
+            throw err;
+        const recordedSelection = selectClaudeAccount({
+            ...selectionInput,
+            allowedAccounts: [lane.account],
+        });
+        selected = {
+            ...recordedSelection,
+            considered: recordedSelection.considered.map((entry) => {
+                const pinnedReason = profilePin.includes(entry.account)
+                    ? accountReasons.find((reason) => reason.account === entry.account)?.reason
+                    : undefined;
+                return typeof pinnedReason === "string"
+                    ? { ...entry, eligible: false, ineligible_reason: pinnedReason }
+                    : entry;
+            }),
+            skipped_accounts: [
+                ...recordedSelection.skipped_accounts.filter((entry) => !profilePin.includes(entry.account)),
+                ...profilePin.map((account) => ({
+                    account,
+                    host: lane.host,
+                    reason: String(accountReasons.find((entry) => entry.account === account)?.reason),
+                })),
+            ],
+        };
+        profilePinUnavailable = true;
+    }
     const historyReason = lane.account === undefined
         ? "load_balance"
         : currentConfig?.enabled !== true
@@ -6815,7 +6859,11 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
                         ? "usage_limit"
                         : "load_balance";
     return {
-        selection: { ...selected, selected_at: ctx.now().toISOString() },
+        selection: {
+            ...selected,
+            ...(profilePinUnavailable ? { reason: "profile_pin_unavailable" } : {}),
+            selected_at: ctx.now().toISOString(),
+        },
         historyReason,
         ...(preservedModel !== undefined ? { preservedModel } : {}),
     };

package/dist/lib/bot/coding-tool-activity.d.ts

@@ -45,7 +45,7 @@ export interface ActivityThreshold {
  * at least `minDistinctDays` calendar days, within the last `windowDays` days.
  */
 export declare const SIGNIFICANT_CODING_TOOL_ACTIVITY: Readonly<ActivityThreshold>;
-export interface ToolActivity {
+interface ToolActivity {
     /** Is the desktop app installed? */
     installed: boolean;
     /** App sessions used within the window (0 when the app is not installed). */
@@ -79,15 +79,8 @@ export interface DetectCodingToolActivityInput {
     extraHqRoots?: string[];
     threshold?: ActivityThreshold;
 }
-/** The desktop apps, by bundle id, and the bundle names they ship under. */
-export declare const DESKTOP_APPS: Readonly<Record<CodingTool, {
-    bundleId: string;
-    bundles: readonly string[];
-}>>;
 /** `originator` the Codex app writes into its sessions' first line. */
 export declare const CODEX_APP_ORIGINATOR = "Codex Desktop";
-/** Claude Code's project folder name for a working directory. */
-export declare function claudeProjectDirName(cwd: string): string;
 /**
  * Is `bundleId` this Info.plist's CFBundleIdentifier? An XML plist is read by
  * key. A binary plist has no readable key/value pairing, so it matches when the
@@ -139,4 +132,5 @@ export declare function pickCodingTool(claude: {
 }, threshold?: ActivityThreshold): CodingTool | null;
 /** Look for the Claude and Codex desktop apps and their recent sessions, and pick one to offer, if any. */
 export declare function detectCodingToolActivity(input: DetectCodingToolActivityInput): CodingToolActivity;
+export {};
 //# sourceMappingURL=coding-tool-activity.d.ts.map

package/dist/lib/bot/coding-tool-activity.js

@@ -48,7 +48,7 @@ export const SIGNIFICANT_CODING_TOOL_ACTIVITY = Object.freeze({
     minDistinctDays: 3,
 });
 /** The desktop apps, by bundle id, and the bundle names they ship under. */
-export const DESKTOP_APPS = Object.freeze({
+const DESKTOP_APPS = Object.freeze({
     claude: { bundleId: "com.anthropic.claudefordesktop", bundles: ["Claude.app"] },
     codex: { bundleId: "com.openai.codex", bundles: ["ChatGPT.app", "Codex.app"] },
 });
@@ -65,10 +65,6 @@ const DAY_MS = 24 * 60 * 60 * 1000;
  * many days older than the window, so a resumed session is still counted.
  */
 const CODEX_FOLDER_MARGIN_DAYS = 31;
-/** Claude Code's project folder name for a working directory. */
-export function claudeProjectDirName(cwd) {
-    return path.resolve(cwd).replace(/[^a-zA-Z0-9]/g, "-");
-}
 function codexHome(home, env) {
     const override = env.CODEX_HOME?.trim();
     return override ? override : path.join(home, ".codex");

package/dist/lib/bot/setup-tool-offer.d.ts

@@ -26,10 +26,6 @@ import type { CodingTool } from "./coding-tool-activity.js";
 export declare const KEEP_GOING_HERE_REPLY = "Keep going here";
 /** The hq-block kind the desktop app draws as the two-button card. */
 export declare const CONTINUE_IN_TOOL_BLOCK_KIND = "continueInTool";
-/** The desktop apps' product names. */
-export declare const CODING_TOOL_NAMES: Readonly<Record<CodingTool, string>>;
-/** The offer's one line. */
-export declare function setupToolOfferLine(tool: CodingTool): string;
 /**
  * The opening of the app's welcome, kept when the offer replaces it: its
  * first sentence (who the bot is and what setup covers). The rest of the

package/dist/lib/bot/setup-tool-offer.js

@@ -26,12 +26,12 @@ export const KEEP_GOING_HERE_REPLY = "Keep going here";
 /** The hq-block kind the desktop app draws as the two-button card. */
 export const CONTINUE_IN_TOOL_BLOCK_KIND = "continueInTool";
 /** The desktop apps' product names. */
-export const CODING_TOOL_NAMES = Object.freeze({
+const CODING_TOOL_NAMES = Object.freeze({
     claude: "Claude",
     codex: "Codex",
 });
 /** The offer's one line. */
-export function setupToolOfferLine(tool) {
+function setupToolOfferLine(tool) {
     return `Looks like you use the ${CODING_TOOL_NAMES[tool]} app. Want to continue setup there?`;
 }
 /**

package/dist/lib/checkpoint-ontology/merge-copies.d.ts

@@ -63,8 +63,8 @@ export declare const MERGE_LISTED_PAIRS_FLAG = "checkpoint.ontology.merge-listed
  * carry the copy's `external_ids` and `web_domains` to the survivor.
  */
 export declare const MERGE_REWRITE_REFS_FLAG = "checkpoint.ontology.merge-rewrite-refs";
-export type CopySkipReason = "no_original" | "original_invalid" | "identity_differs" | "not_in_duplicate_group" | "group_size" | "type_differs" | "names_differ" | "numbered_copy" | "not_listed" | "listed_conflict";
-export type PairKind = "numbered" | "variants" | "listed";
+type CopySkipReason = "no_original" | "original_invalid" | "identity_differs" | "not_in_duplicate_group" | "group_size" | "type_differs" | "names_differ" | "numbered_copy" | "not_listed" | "listed_conflict";
+type PairKind = "numbered" | "variants" | "listed";
 export interface CopySkip {
     copy: string;
     reason: CopySkipReason;
@@ -93,7 +93,7 @@ export interface ListedPair {
     /** Provider -> resolution, applied only when `rewriteRefs` is on and the ids conflict. */
     resolve_external_ids?: Record<string, ExternalIdResolution>;
 }
-export interface CopyPlan extends CopyPair {
+interface CopyPlan extends CopyPair {
     add_aliases: string[];
     /** Copy names the original lacks that another entity already holds, so they do not move. */
     dropped_aliases: string[];
@@ -196,4 +196,5 @@ export declare function findListedPairs(index: EntityIndex, only: ListedPair[]):
  * local copy files only.
  */
 export declare function mergeCopies(options: MergeCopiesOptions): Promise<MergeCopiesReport>;
+export {};
 //# sourceMappingURL=merge-copies.d.ts.map

package/dist/lib/checkpoint-ontology/tree.d.ts

@@ -25,7 +25,6 @@ export interface EntityIndex {
     /** Files under `ontology/entities/` that fail validation. Never written. */
     invalid: Set<string>;
 }
-export declare function emptyIndex(): EntityIndex;
 /** Add one parsed entity to the index (also used for entities created mid-run). */
 export declare function indexEntity(index: EntityIndex, entity: IndexedEntity): void;
 /** Record that the entity at `rel` answers to `alias`. */

package/dist/lib/checkpoint-ontology/tree.js

@@ -18,7 +18,7 @@ function add(map, key, value) {
     }
     set.add(value);
 }
-export function emptyIndex() {
+function emptyIndex() {
     return {
         byRel: new Map(),
         canonical: new Map(),

package/dist/lib/core-utils/qmd-reindex-after-sync.d.ts

@@ -1,8 +1,6 @@
 import { type EmbedLockDependencies } from "../search-index/embed-lock.js";
 import { type LoadGateDependencies } from "../search-index/load-gate.js";
 import { type UtilityIo } from "./common.js";
-export declare const QMD_REINDEX_STARTUP_WARNING_FLAG = "qmd.reindex-startup-warning";
-export declare const QMD_REINDEX_STARTUP_WARNING_FLAG_FALLBACK = false;
 export type QmdReindexOptions = UtilityIo & {
     cwd?: string;
     /** Test seams; default to the real search-index implementations. */

package/dist/lib/core-utils/qmd-reindex-after-sync.js

@@ -20,8 +20,8 @@ import { resolveProcessFlagGate } from "../flag-registry.js";
 import { qmdReindexSingleFlightEnabled } from "../search-index/reindex-single-flight-flag.js";
 import { isQmdNativeBindingError, QMD_NATIVE_BINDING_REMEDY, } from "../../utils/qmd-native-binding-error.js";
 import { ioFor, line } from "./common.js";
-export const QMD_REINDEX_STARTUP_WARNING_FLAG = "qmd.reindex-startup-warning";
-export const QMD_REINDEX_STARTUP_WARNING_FLAG_FALLBACK = false;
+const QMD_REINDEX_STARTUP_WARNING_FLAG = "qmd.reindex-startup-warning";
+const QMD_REINDEX_STARTUP_WARNING_FLAG_FALLBACK = false;
 function qmdStartupFailureWarningsEnabled() {
     return resolveProcessFlagGate(QMD_REINDEX_STARTUP_WARNING_FLAG, { fallback: QMD_REINDEX_STARTUP_WARNING_FLAG_FALLBACK }, () => QMD_REINDEX_STARTUP_WARNING_FLAG_FALLBACK);
 }

package/dist/lib/daemon/convergence.d.ts

@@ -7,8 +7,6 @@
  * on disk. Policy hq-self-updater-must-verify-convergence-after-install: the
  * caller reports a mismatch as a failure; it is never swallowed.
  */
-export declare const CONVERGENCE_TIMEOUT_MS = 10000;
-export declare const CONVERGENCE_POLL_MS = 500;
 export interface ConvergenceResult {
     converged: boolean;
     expected: string;

package/dist/lib/daemon/convergence.js

@@ -9,8 +9,8 @@
  */
 import { spawnSync } from "node:child_process";
 import { hqdRequest } from "./protocol.js";
-export const CONVERGENCE_TIMEOUT_MS = 10_000;
-export const CONVERGENCE_POLL_MS = 500;
+const CONVERGENCE_TIMEOUT_MS = 10_000;
+const CONVERGENCE_POLL_MS = 500;
 /** Ping hqd over its socket and return the version it reports. */
 export async function pingHqdVersion(socketPath, timeoutMs = 2_000) {
     const result = (await hqdRequest("ping", {}, { socketPath, timeoutMs }));

package/dist/lib/daemon/flag-monitor.d.ts

@@ -1,5 +1,3 @@
-export declare const HQ_ANYWHERE_FLAG_REFRESH_INTERVAL_MS = 30000;
-export declare const HQ_ANYWHERE_FLAG_MAX_STALENESS_MS = 60000;
 export interface BoundedDaemonFlagMonitorOptions {
     read: () => Promise<boolean>;
     now?: () => number;

package/dist/lib/daemon/flag-monitor.js

@@ -1,6 +1,6 @@
 import { performance } from "node:perf_hooks";
-export const HQ_ANYWHERE_FLAG_REFRESH_INTERVAL_MS = 30_000;
-export const HQ_ANYWHERE_FLAG_MAX_STALENESS_MS = 60_000;
+const HQ_ANYWHERE_FLAG_REFRESH_INTERVAL_MS = 30_000;
+const HQ_ANYWHERE_FLAG_MAX_STALENESS_MS = 60_000;
 /**
  * Refreshes a long-running daemon's flag independently of incoming requests.
  * A failed read keeps the last successful decision only until its 60s age limit.

package/dist/lib/daemon/legacy-sync-env.d.ts

@@ -4,7 +4,6 @@
  * sync limits. This module is deliberately tolerant: a bad or missing drop-in
  * must never stop daemon planning.
  */
-export declare const LEGACY_SYNC_DROPIN_DIR = "/etc/systemd/system/outpost-sync.service.d";
 /** Read simple KEY=VALUE and quoted "KEY=VALUE" Environment directives. */
 export declare function readLegacySyncEnv(platform: NodeJS.Platform, directory?: string): Record<string, string>;
 //# sourceMappingURL=legacy-sync-env.d.ts.map

package/dist/lib/daemon/legacy-sync-env.js

@@ -6,7 +6,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-export const LEGACY_SYNC_DROPIN_DIR = "/etc/systemd/system/outpost-sync.service.d";
+const LEGACY_SYNC_DROPIN_DIR = "/etc/systemd/system/outpost-sync.service.d";
 function assignments(text, into) {
     let inService = false;
     for (const rawLine of text.split(/\r?\n/)) {

package/dist/lib/daemon/ops/journal.d.ts

@@ -9,7 +9,6 @@
  * <project>/journal/ is used, and one is opened (same template as
  * `journal.sh open`) when none exists.
  */
-export declare const JOURNAL_SECTIONS: Record<string, string>;
 export declare class JournalOpError extends Error {
     readonly code: string;
     constructor(code: string, message: string);

package/dist/lib/daemon/ops/journal.js

@@ -12,7 +12,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 const SLUG_RE = /^[A-Za-z0-9_][A-Za-z0-9._-]*$/;
-export const JOURNAL_SECTIONS = {
+const JOURNAL_SECTIONS = {
     decisions: "## Decisions",
     open: "## Open threads",
     findings: "## Findings",

package/dist/lib/daemon/ops/mcp.d.ts

@@ -12,7 +12,6 @@ export interface McpToolResult {
     isError?: boolean;
 }
 export declare function jsonResult(value: unknown): McpToolResult;
-export declare const HQ_MCP_HTTP_TIMEOUT_MS = 30000;
 export declare function resolveHqMcpEndpoint(env?: NodeJS.ProcessEnv): URL;
 export declare function defaultMcpToken(): Promise<string>;
 export interface HqMcpBridgeOptions {

package/dist/lib/daemon/ops/mcp.js

@@ -16,7 +16,7 @@ export function jsonResult(value) {
     const structured = value && typeof value === "object" && !Array.isArray(value) ? value : { value };
     return { content: [{ type: "text", text: JSON.stringify(value, null, 2) }], structuredContent: structured };
 }
-export const HQ_MCP_HTTP_TIMEOUT_MS = 30_000;
+const HQ_MCP_HTTP_TIMEOUT_MS = 30_000;
 export function resolveHqMcpEndpoint(env = process.env) {
     try {
         return resolveEndpoint(env);

package/dist/lib/daemon/ops/memory.d.ts

@@ -2,12 +2,10 @@
  * memory.get / memory.put ops (hq-anywhere US-009): session-scoped notes
  * persisted at workspace/sessions/<sid>/hqd-memory.json under HQ_ROOT.
  */
-export declare const MEMORY_FILE = "hqd-memory.json";
 export declare class MemoryOpError extends Error {
     readonly code: string;
     constructor(code: string, message: string);
 }
-export declare function memoryPath(hqRoot: string, sessionId: string): string;
 export declare function memoryPut(hqRoot: string, sessionId: string, key: string, value: unknown, now?: Date): {
     key: string;
     updatedAt: string;

package/dist/lib/daemon/ops/memory.js

@@ -5,7 +5,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 const SESSION_RE = /^[A-Za-z0-9._-]+$/;
-export const MEMORY_FILE = "hqd-memory.json";
+const MEMORY_FILE = "hqd-memory.json";
 const MAX_VALUE_BYTES = 256 * 1024;
 export class MemoryOpError extends Error {
     code;
@@ -15,7 +15,7 @@ export class MemoryOpError extends Error {
         this.name = "MemoryOpError";
     }
 }
-export function memoryPath(hqRoot, sessionId) {
+function memoryPath(hqRoot, sessionId) {
     if (!SESSION_RE.test(sessionId) || sessionId === "." || sessionId === "..") {
         throw new MemoryOpError("bad_args", "sessionId may only contain letters, digits, '.', '_' and '-'");
     }

package/dist/lib/daemon/ops/policy.d.ts

@@ -61,13 +61,6 @@ export interface PolicyCheckResult {
         version: number;
     };
 }
-/**
- * The scope authorizer reads the session's company from
- * workspace/sessions/<sid>/meta.yaml (or scope-capability.json). hqd binds a
- * session id of its own per company + caller, so a check never borrows the
- * binding of an unrelated session.
- */
-export declare function bindCheckSession(hqRoot: string, company: string | undefined, callerSession: string | undefined, now: Date): string;
 export interface PolicyCheckDeps {
     hqRoot: string;
     index: PolicyIndex;

package/dist/lib/daemon/ops/policy.js

@@ -160,7 +160,7 @@ function runScript(script, payload, env, cwd, timeoutMs) {
  * session id of its own per company + caller, so a check never borrows the
  * binding of an unrelated session.
  */
-export function bindCheckSession(hqRoot, company, callerSession, now) {
+function bindCheckSession(hqRoot, company, callerSession, now) {
     const caller = (callerSession ?? "default").replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 80) || "default";
     const scope = company ?? "personal";
     const sid = `hqd-${scope}-${caller}`;

package/dist/lib/daemon/supervisor.d.ts

@@ -26,7 +26,6 @@ import type { MachineType } from "./machine-type.js";
 import type { ControlRequest } from "./requests.js";
 import { syncPassResult } from "./sync-runner.js";
 export declare const STOP_ESCALATION_MS = 10000;
-export declare const CLI_UPDATE_SYNC_IDLE_MAX_MS: number;
 export declare const CLI_UPDATE_SYNC_IDLE_KILL_GRACE_MS = 60000;
 /** After a handoff, how long a replaced unit must stay up before the next one is replaced. */
 export declare const HANDOFF_STAGGER_MS = 15000;

package/dist/lib/daemon/supervisor.js

@@ -27,7 +27,7 @@ const BACKOFF_BASE_MS = 1_000;
 const BACKOFF_MAX_MS = 60_000;
 const HEALTHY_RUN_MS = 60_000;
 export const STOP_ESCALATION_MS = 10_000;
-export const CLI_UPDATE_SYNC_IDLE_MAX_MS = 10 * 60_000;
+const CLI_UPDATE_SYNC_IDLE_MAX_MS = 10 * 60_000;
 export const CLI_UPDATE_SYNC_IDLE_KILL_GRACE_MS = 60_000;
 const MESH_OWNER_RECHECK_MS = 15_000;
 const MESH_OWNER_LOG_INTERVAL_MS = 10 * 60_000;

package/dist/lib/daemon/sync-runner-bundle.d.ts

@@ -3,7 +3,7 @@ import * as fs from "node:fs";
 export declare const SYNC_RUNNER_BUNDLE_RUNNER_FILE = "bin/sync-runner.js";
 export declare const SYNC_RUNNER_BUNDLE_METADATA_FILE = "package.json";
 export declare const SYNC_RUNNER_BUNDLE_DIRECTORY = "hq-cloud-sync-runner";
-export declare const SYNC_RUNNER_BUNDLE_FORMAT_VERSION = 1;
+declare const SYNC_RUNNER_BUNDLE_FORMAT_VERSION = 1;
 /** Root directory where validated sync-runner bundles are selected. */
 export declare function syncRunnerBundleStageRoot(daemonRoot: string): string;
 /** package.json contract that the hq-cli build step emits beside the bundled bin directory. */
@@ -41,4 +41,5 @@ export declare function stagedSyncRunnerVersion(runnerPath: string): string;
  * Only a completed, fsynced directory is returned; temp siblings are ignored.
  */
 export declare function stageSyncRunnerBundle(options: StageSyncRunnerBundleOptions): StagedSyncRunnerBundle;
+export {};
 //# sourceMappingURL=sync-runner-bundle.d.ts.map

package/dist/lib/daemon/sync-runner-bundle.js

@@ -8,7 +8,7 @@ import { ensurePrivateDir } from "./paths.js";
 export const SYNC_RUNNER_BUNDLE_RUNNER_FILE = "bin/sync-runner.js";
 export const SYNC_RUNNER_BUNDLE_METADATA_FILE = "package.json";
 export const SYNC_RUNNER_BUNDLE_DIRECTORY = "hq-cloud-sync-runner";
-export const SYNC_RUNNER_BUNDLE_FORMAT_VERSION = 1;
+const SYNC_RUNNER_BUNDLE_FORMAT_VERSION = 1;
 /** Root directory where validated sync-runner bundles are selected. */
 export function syncRunnerBundleStageRoot(daemonRoot) {
     return path.join(daemonRoot, "bundles", "sync-runner");